Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Edge bypass and exposure V-014
Finds databases open to the internet, and origins that can be reached around the CDN meant to front them.
Checks
| Checks | Needs |
|---|---|
| Finds publicly accessible databases open to the internet on their port. | rds instance, ec2 security group |
| Says when the security groups of a public database could not be read. | rds instance, ec2 security group |
| Finds origin instances reachable from the internet around their CDN. | ec2 instance, ec2 security group |
| Finds load balancers reachable from the internet around their CDN. | k8s service |
| Finds ingresses reachable from the internet around their CDN. | k8s ingress |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeCluster(publicAccessCidrs) / GetPublicAccessBlock / ListFunctionUrlConfigs(AuthType) → restrict by IaC; reversible